5 ms·

Google recommends against hosting their tracking javascript locally, but that in combination with a server-side proxy (POSTING to https://example.com/a https://

Google recommends against hosting their tracking javascript locally, but that in combination with a server-side proxy (POSTING to https://example.com/a https://example.com/a forwards to https://analytics.google.com/collect https://analytics.google.com/collect) might be the most resilient to ad blocking techniques.

tarr11 11y ago
Yeah, this feels like the next step in the arms race. Just use some random URL to post this to, to avoid any regex based ad blockers.
- JupiterMoon 11y ago
  Good. I would like to encourage people to move to a whitelist based approach to filtering javascript...
- HappyTypist 11y ago
  We will then have rules based on file hashes. People will obfuscate them, so it'll now be based on function signatures and API calls (get locale, screen size, OS, set cookie? No network requests for you). When that's bypassed, maybe we will see DPI of network requests for patterns. The arms race is only going to continue if trackers play the game. I think we'll probably see server side analytics instead, with Google and so making Apache/nginx/express modules and middlewear.
pdkl95 11y ago
Wow. This would be great; once I have a few examples of this kind of behavior, I'm certain I can get a lot more people to turn off Javascript by default. (I know quite a few people that don't want Google logging their web browsing and who take active to prevent it) This is another "tragedy of the commons" situation, just like what we've seen recently in advertising, where escalating behavior forced a backlash. If you want to prevent a future backlash against analytics, stop aggregating the data.
- stevesearer 11y ago
  Serious question that I haven't googled, but for analytics logging what should a site administrator use that anti-tracking folks would be happy with? Others here have suggested "processing the server logs", but is there some sort of locally hosted thing I can add that will help me get the same stats google analytics does? Or are there any third party hosted analytics services that provide similar services without being aggregated?
  - blumkvist 11y ago
    Nothing that both parties would be content with.
  - pdkl95 11y ago
    (my apologies for a late response) > third party hosted That is the exact thing that needs to be avoided. By using such a service, you are allowing that service to aggregate browsing logs. It doesn't matter if any particular site logs it's OWN requests; it is expected that if I ask you for a page, you (as the 2nd party) may choose to remember that transaction. Without aggregation, any service only knows about the people that choose to interact with that service. This mirrors fairly closely traditional expectations where e.g. a shopkeeper knows that you walked into their shop, but most people would find it more than a little creepy if that same shopkeeper allowed a 3rd party to kept detailed notes about their customers. The problems start when you decide to let other people eavesdrop on what should be a two-party transaction, especially when they have access to a lot of these interactions. By aggregating logs, the knowledge about someone changes from known that they used a particular service, to knowing their pattern-of-life[1] (and more). > what should a site administrator use I'm truly sorry that there are not a lot of options (that I know of) for better server-log analysis. This area has suffered a lot of damage from the Service As A Software Substitute[2] monopolies. I suggest pressuring vendors for better analytics software. There may be a market for better local-only, no-services-involved server-log analysis tools. Until such tools exist (or are found), you're in a hard place, because lack of tools is not justification for betraying the activities of your users to a snooping 3rd party. [1] https://en.wikipedia.org/wiki/Pattern-of-life_analysis https://en.wikipedia.org/wiki/Pattern-of-life_analysis [2] http://www.gnu.org/philosophy/who-does-that-server-really-serve.en.html http://www.gnu.org/philosophy/who-does-that-server-really-se...

tarr11 11y ago

Yeah, this feels like the next step in the arms race. Just use some random URL to post this to, to avoid any regex based ad blockers.

JupiterMoon 11y ago
Good. I would like to encourage people to move to a whitelist based approach to filtering javascript...
HappyTypist 11y ago
We will then have rules based on file hashes. People will obfuscate them, so it'll now be based on function signatures and API calls (get locale, screen size, OS, set cookie? No network requests for you). When that's bypassed, maybe we will see DPI of network requests for patterns. The arms race is only going to continue if trackers play the game. I think we'll probably see server side analytics instead, with Google and so making Apache/nginx/express modules and middlewear.

pdkl95 11y ago

Wow. This would be great; once I have a few examples of this kind of behavior, I'm certain I can get a lot more people to turn off Javascript by default. (I know quite a few people that don't want Google logging their web browsing and who take active to prevent it) This is another "tragedy of the commons" situation, just like what we've seen recently in advertising, where escalating behavior forced a backlash. If you want to prevent a future backlash against analytics, stop aggregating the data.

stevesearer 11y ago
Serious question that I haven't googled, but for analytics logging what should a site administrator use that anti-tracking folks would be happy with? Others here have suggested "processing the server logs", but is there some sort of locally hosted thing I can add that will help me get the same stats google analytics does? Or are there any third party hosted analytics services that provide similar services without being aggregated?
- blumkvist 11y ago
  Nothing that both parties would be content with.
- pdkl95 11y ago
  (my apologies for a late response) > third party hosted That is the exact thing that needs to be avoided. By using such a service, you are allowing that service to aggregate browsing logs. It doesn't matter if any particular site logs it's OWN requests; it is expected that if I ask you for a page, you (as the 2nd party) may choose to remember that transaction. Without aggregation, any service only knows about the people that choose to interact with that service. This mirrors fairly closely traditional expectations where e.g. a shopkeeper knows that you walked into their shop, but most people would find it more than a little creepy if that same shopkeeper allowed a 3rd party to kept detailed notes about their customers. The problems start when you decide to let other people eavesdrop on what should be a two-party transaction, especially when they have access to a lot of these interactions. By aggregating logs, the knowledge about someone changes from known that they used a particular service, to knowing their pattern-of-life[1] (and more). > what should a site administrator use I'm truly sorry that there are not a lot of options (that I know of) for better server-log analysis. This area has suffered a lot of damage from the Service As A Software Substitute[2] monopolies. I suggest pressuring vendors for better analytics software. There may be a market for better local-only, no-services-involved server-log analysis tools. Until such tools exist (or are found), you're in a hard place, because lack of tools is not justification for betraying the activities of your users to a snooping 3rd party. [1] https://en.wikipedia.org/wiki/Pattern-of-life_analysis https://en.wikipedia.org/wiki/Pattern-of-life_analysis [2] http://www.gnu.org/philosophy/who-does-that-server-really-serve.en.html http://www.gnu.org/philosophy/who-does-that-server-really-se...